No, Microsoft Is Not Suddenly 'Defying' A Court Order To Turn Over Emails

from the that's-not-how-this-works dept

A very stupid story broke out over the weekend and got some buzz after some people read way too much into some legal maneuvering. As you may recall, back in April a court ruled that Microsoft had to hand over email data stored in Ireland based on a warrant issued in the US under the (incredibly outdated) Electronic Communications Privacy Act (ECPA). Microsoft, quite reasonably, fought back, pointing out that a warrant only applies within the US and not to foreign countries. The DOJ (and the original judge) claimed that an ECPA warrant isn't really like a warrant at all, but rather a "hybrid warrant/subpoena." But, Microsoft (rightly) points out that this is the DOJ wanting the best of both worlds -- while ignoring the protections of both. Here was the crux of Microsoft's argument:

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

Unfortunately, as we noted at the end of July, the judge in the case, Loretta Preska, sided with the DOJ.

On Friday, Judge Preska did what was basically a procedural move. When she had made the original ruling, she had put a stay on the ruling, fully expecting Microsoft to appeal. This is fairly standard procedure. When a district court judge knows a ruling is likely to be appealed the judge will frequently "stay" the ruling pending the appeal. The DOJ claimed that this was a procedural error and that the particular order, for a whole host of boring legal reasons, is not an "appealable order" and that the stay is inappropriate for that reason. Everyone involved in the case -- the Judge, Microsoft and the DOJ -- knows that it's going to go to an appeal. There's just a very, very minor debate over the correct legal process to get it to appeal. Judge Preska agreed that the original order probably is not appealable, and thus the stay order makes no sense, since it was only pending the appeal. Thus, to speed things along, she lifted the stay, noting quite clearly that this was to help along the appeal process:

Both parties share the common goal of permitting the Court of Appeals to hear this case as soon as possible. Their disagreement concerns the correct path to that goal. In order words, the parties agree on the destination but the route to get there is the subject of hot dispute.

Basically, this was a very minor move to push things onto the proper legal track to get this case before the appeals court. Because the original order isn't technically appealable, the stay didn't make any sense, so the Judge removed it, with everyone knowing that Microsoft won't hand over the info, leading the Judge to issue a different ruling that can be appealed. I saw the news on Friday and realized it wasn't worth writing about, because it's basically nothing.

However, a few sites appear to have totally misread this into being a big deal. If you don't read carefully, seeing that a judge lifted a stay suggests that Microsoft is being forced to hand over the info. But anyone who actually read any of the details (including the decision and/or the Reuters report that broke the news) should have known that wasn't actually the case. Microsoft then said the most obvious thing in the world: that it wasn't handing over the info, because it hasn't done that all along and this is what it needs to do to get the case to appeal. But a bunch of sites misread the whole thing as if Microsoft was somehow taking a new stand, rather than just procedurally moving things forward. A site called WindowsITPro wrote up that Microsoft was now "defying" a court order and this somehow proved it was a heroic company, fighting for its customers:

Despite a federal court order directing Microsoft to turn overseas-held email data to federal authorities, the software giant said Friday it will continue to withhold that information as it waits for the case to wind through the appeals process. The judge has now ordered both Microsoft and federal prosecutors to advise her how to proceed by next Friday, September 5.

Let there be no doubt that Microsoft's actions in this controversial case are customer-centric. The firm isn't just standing up to the US government on moral principles. It's now defying a federal court order.

They did this, even though in the very next paragraph the Microsoft statement itself points out that this is nothing more than a procedural issue. Unfortunately, sites like Slashdot also picked up on the WindowsITPro story and repeated the misleading headline.

Yes, Microsoft is trying to protect its customers' email data (held in Ireland) in this case. And yes, it's an important case. But Microsoft (and a variety of other tech companies that filed amicus briefs in support of Microsoft's position) took that stand months ago. What happened on Friday was a minor procedural effort to move the case along, and didn't represent any big new "heroic" move by Microsoft to "defy" a court order. Nothing to see here, move on. The appeals court is where this case will actually get interesting.

Re: who gives ... DoJ

Well then, when you get your next jury duty summons, especially for Federal jury duty, don't try to get out of it.

Perform juror oriented due diligent research on the whole process as well has how to detect lying, effective reasoning, emotional manipulation and so on. Be "The Juror From Hell". At deliberation, make sure your fellow jurors know how bad the cases presented actually were. Make the verdict fit! A couple of prepared and intelligent jurors in each jury can improve the whole jury system, even if most jurors choose to be brain dead dolts. In short, do something beyond complaining!

surely the whole problem is that the judge did the wrong thing and sided with the DoJ. had she not have done that, this issue wouldn't still be in the 'sorting out' stage. what MS said seems to be correct that the DoJ wants to take the bits it likes from both of the choices, add them together and then ignore totally the bits it doesn't like, forcing MS to do what is known to be unenforceable.

Re: WindowsITPro

Well, Microsoft is not rolling over here. It's just not a new development. And it would be rather bad for their bottom line if they did roll over in public.

And it is not like the DOJ actually needs to kick them in the balls in public since they are steamrolling over proper and public process with redactions, classification, privilege, secret court cases and what not.

So expect Microsoft to win this case eventually, make a big spectacle of it, and feed the DOJ and NSA any information it wants anyway, just not on the record.

Re: Re: WindowsITPro

MS is probably even more afraid of getting caught breaking Ireland's data protection laws, because not only would that is serious gaol time for the staff responsible, it would open MS up to fines based on total global profits.

Re: Can Microsoft actually turn over the emails?

Re: Can Microsoft actually turn over the emails?

I'm no expert, but my understanding is that it would at least break EU data protection directives, if not local Irish law, although in reality I think it gets very complicated in this case, in ways I don't have time to research right now. Typically, however, EU law is built to be very concerned with data protection, especially when the data is being sent outside of its jurisdiction. I'd expect there to be at least a challenge locally.

Re: Can Microsoft actually turn over the emails?

No. Microsoft USA, headquartered in Redmond, Washington, even if it wants to, *cannot* give the emails. The people sitting in the offices in Redmond cannot log into the servers in Ireland. At best, they can only send orders down the chain of management to Microsoft Europe, headquartered in Dublin, Ireland. Once the order arrives there, the employees there, who will be citizens of Ireland and subject to both Irish and EU data protection laws, will talk to their legal department. Legal will reply back, saying "No, we can't give Microsoft USA the data just because they ask, we'd be breaking our own laws if we do".At that point, Microsoft USA can just shrug its shoulders and reply back to the judge saying "Well, we tried, but it turns out we can't fulfill the order". The problem here is that all this could have been avoided if the US DoJ had gone through Interpol and worked with the Irish police to get at the data.

If true, that is a relief

It reminds me of a middle-ages dilemma in which the masons being an esoteric society ran contrary to the Church, which would often command lords to arrest those satanic monsters.

Of course the lord in question would have to comply, but actually arresting the masons would mean not getting his castle (wall, bridge, whatever) built.

So he'd send some footmen into town making a lot of noise about how they're looking for those terrible satanic masons and oh how they better not find any because then they'll have to arrest them and there will be trouble. And the masons would in a hurry realize they need to get scarce.

And the footmen would come back empty handed and the lord would report to the church that he tried, but those pesky masons cleared town.

Re: Can Microsoft actually turn over the emails?

Well, It's depends who you ask.The people in the U.S.A. will tell you they can. Because Microsoft offers services in the USA so it is bound by all kinds of agreements, like the Patriot Act and others.The problem is, in Ireland (and in the European Union as a whole) the Laws/Rules concerning privacy are a lot more strict.

The Policy of the EU in these situations is as follows:If the court/ police has a Warrant to acces computers located in the U.S. whom can acces the data, there is no problem.The problem is, they can't. The stored data can only be accessed by computers in Ireland.In that case, the DoJ CANNOT FORCE Microsoft to hand over the data (since the physical location is outside of their jurisdiction). What they can do, is ASK Microsoft to hand it over as evidence. BUT: The Terms of Service of MS state that they will only hand over data to third parties if they are FORCED by law! Wich, in that situation, is not happening. So... MS won't turn over the data.The last thing the DoJ can do in that case, is write a Official Request to the Autorithies in Ireland if they can write a Warrent.But then the EU COULD make a fuss, stating that the data may not leave EU-borders and they can FORCE Ireland to decline the request.If that happens, the DoJ can only do one thing: "Go suck a lemmon!" Because that's really the end of the line. If Ireland/EU says "Nope!", they can summit/ appeal/ threaten as much as they like. They will never ever get the data.Q.E.D.

They actually are defying.

Actually, they ARE (or soon will be) defying the order. Because the court told them to. From the court:

"[t]o obtain appellate review, the subpoenaed person ordinarily must defy the district court's enforcement order, be held in contempt, and then appeal the contempt order, which is regarded as final under Id. § 1291."